[frontend/backend] feat(scv): assign Security Domains to payloads (#4119)

openaev-api/src/main/java/io/openaev/importer/V1_DataImporter.java

@@ -21,6 +21,7 @@
 import io.openaev.database.repository.*;
 import io.openaev.injectors.challenge.model.ChallengeContent;
 import io.openaev.injectors.channel.model.ChannelContent;
+import io.openaev.rest.domain.DomainService;
 import io.openaev.rest.exercise.exports.VariableWithValueMixin;
 import io.openaev.rest.inject.form.InjectDependencyInput;
 import io.openaev.rest.injector_contract.InjectorContractContentUtils;
@@ -80,6 +81,7 @@ public class V1_DataImporter implements Importer {
   private final InjectDependenciesRepository injectDependenciesRepository;
   private final PayloadCreationService payloadCreationService;
   private final CollectorRepository collectorRepository;
+  private final DomainService domainService;
 
   private final InjectorContractContentUtils injectorContractContentUtils;
 
@@ -220,6 +222,28 @@ private Tag createTag(JsonNode jsonNode) {
     return tag;
   }
 
+  // -- DOMAINS PATTERN --
+  private Set<Domain> importDomains(JsonNode importNode, String prefix) {
+    Set<Domain> domains = new HashSet<>();
+    resolveJsonElements(importNode, prefix + "domains")
+        .forEach(
+            nodeDomain -> {
+              JsonNode nameNode = nodeDomain.get("domain_name");
+              if (nameNode == null) {
+                return;
+              }
+
+              Domain domainCreated =
+                  this.domainService.upsert(
+                      nameNode.textValue(), nodeDomain.get("domain_color").textValue());
+              domains.add(domainCreated);
+            });
+    if (domains.isEmpty()) {
+      return Set.of(new Domain(null, "To classify", "#FFFFFF", Instant.now(), null));
+    }
+    return domains;
+  }
+
   // -- ATTACK PATTERN --
   private List<String> importAttackPattern(
       JsonNode importNode, String prefix, Map<String, Base> baseIds) {
@@ -1353,8 +1377,10 @@ private String importPayloadAsMain(
     PayloadCreateInput payloadCreateInput = buildPayload(payloadNode);
     payloadCreateInput.setOutputParsers(
         buildOutputParsersFromPayloadJsonNode(payloadNode, baseIds));
+    payloadCreateInput.setDomains(importDomains(payloadNode, "payload_"));
 
     List<String> attackPatternIds = importAttackPattern(payloadNode, "payload_", baseIds);
+
     payloadCreateInput.setAttackPatternsIds(attackPatternIds);
     payloadCreateInput.setDetectionRemediations(buildDetectionRemediationsJsonNode(payloadNode));
     Payload payload = this.payloadCreationService.createPayload(payloadCreateInput);
@@ -1392,6 +1418,8 @@ private Optional<InjectorContract> importPayload(
     payloadCreateInput.setOutputParsers(
         buildOutputParsersFromPayloadJsonNode(payloadNode, baseIds));
 
+    payloadCreateInput.setDomains(importDomains(payloadNode, "payload_"));
+
     List<String> attackPatternIds = importAttackPattern(payloadNode, "payload_", baseIds);
     payloadCreateInput.setAttackPatternsIds(attackPatternIds);
     payloadCreateInput.setDetectionRemediations(buildDetectionRemediationsJsonNode(payloadNode));

openaev-api/src/main/java/io/openaev/migration/V4_52__Implement_Domains_notion.java

@@ -0,0 +1,90 @@
+package io.openaev.migration;
+
+import java.sql.Statement;
+import org.flywaydb.core.api.migration.BaseJavaMigration;
+import org.flywaydb.core.api.migration.Context;
+import org.springframework.stereotype.Component;
+
+@Component
+public class V4_52__Implement_Domains_notion extends BaseJavaMigration {
+  @Override
+  public void migrate(Context context) throws Exception {
+    try (Statement stmt = context.getConnection().createStatement()) {
+      stmt.execute(
+          """
+                                CREATE TABLE domains (
+                                    domain_id VARCHAR(255) NOT NULL CONSTRAINT domains_pkey PRIMARY KEY,
+                                    domain_name VARCHAR(255) NOT NULL UNIQUE,
+                                    domain_color VARCHAR(255) NOT NULL DEFAULT '#FFFFFF',
+                                    domain_created_at TIMESTAMPTZ DEFAULT now(),
+                                    domain_updated_at TIMESTAMPTZ DEFAULT now()
+                                );
+                            """);
+
+      stmt.execute(
+          """
+        CREATE INDEX idx_domains_domain_name
+        ON domains(domain_name);
+      """);
+
+      stmt.execute(
+          """
+                                CREATE TABLE payloads_domains (
+                                    payload_id VARCHAR(255) NOT NULL,
+                                    domain_id VARCHAR(255) NOT NULL,
+                                    PRIMARY KEY (payload_id, domain_id),
+                                    CONSTRAINT fk_payloads_domains_domain FOREIGN KEY (domain_id) REFERENCES domains(domain_id) ON DELETE CASCADE,
+                                    CONSTRAINT fk_payloads_domains_payload FOREIGN KEY (payload_id) REFERENCES payloads(payload_id) ON DELETE CASCADE
+                                );
+                            """);
+
+      stmt.execute("CREATE INDEX idx_payloads_domains_domain_id ON payloads_domains(domain_id);");
+      stmt.execute("CREATE INDEX idx_payloads_domains_payload_id ON payloads_domains(payload_id);");
+
+      stmt.execute(
+          """
+                        CREATE TABLE injectors_contracts_domains (
+                            injector_contract_id VARCHAR(255) NOT NULL,
+                            domain_id VARCHAR(255) NOT NULL,
+                            PRIMARY KEY (injector_contract_id, domain_id),
+
+                            CONSTRAINT fk_icd_injector_contract
+                                FOREIGN KEY (injector_contract_id)
+                                REFERENCES injectors_contracts(injector_contract_id)
+                                ON DELETE CASCADE,
+
+                            CONSTRAINT fk_icd_domain
+                                FOREIGN KEY (domain_id)
+                                REFERENCES domains(domain_id)
+                                ON DELETE CASCADE
+                        );
+                    """);
+
+      stmt.execute(
+          "CREATE INDEX idx_icd_injector_contract_id ON injectors_contracts_domains(injector_contract_id);");
+      stmt.execute("CREATE INDEX idx_icd_domain_id ON injectors_contracts_domains(domain_id);");
+
+      stmt.execute(
+          "INSERT INTO domains (domain_id, domain_name, domain_color) VALUES "
+              + "  (gen_random_uuid(), 'Endpoint', '#389CFF'),"
+              + "  (gen_random_uuid(), 'Network', '#009933'),"
+              + "  (gen_random_uuid(), 'Web App', '#FF9933'),"
+              + "  (gen_random_uuid(), 'E-mail Infiltration', '#FF6666'),"
+              + "  (gen_random_uuid(), 'Data Exfiltration', '#9933CC'),"
+              + "  (gen_random_uuid(), 'URL Filtering', '#66CCFF'),"
+              + "  (gen_random_uuid(), 'Cloud', '#9999CC'),"
+              + "  (gen_random_uuid(), 'Table-Top', '#FFCC33'),"
+              + "  (gen_random_uuid(), 'To classify', '#FFFFFF');");
+    }
+  }
+}
+
+// Rollback script
+
+// DROP TABLE IF EXISTS domains;
+// DROP INDEX IF EXISTS idx_payloads_domains_domain_id;
+// DROP INDEX IF EXISTS idx_payloads_domains_payload_id;
+// DROP TABLE IF EXISTS payloads_domains;
+// DROP INDEX IF EXISTS idx_injectors_contracts_domains_domain_id;
+// DROP INDEX IF EXISTS idx_injectors_contracts_domains_injector_contract_id;
+// DROP TABLE IF EXISTS injectors_contracts_domains;

openaev-api/src/main/java/io/openaev/rest/domain/DomainApi.java

@@ -0,0 +1,54 @@
+package io.openaev.rest.domain;
+
+import io.openaev.aop.LogExecutionTime;
+import io.openaev.aop.RBAC;
+import io.openaev.database.model.Action;
+import io.openaev.database.model.Domain;
+import io.openaev.database.model.ResourceType;
+import io.openaev.rest.domain.form.DomainBaseInput;
+import io.openaev.rest.helper.RestBehavior;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.transaction.Transactional;
+import jakarta.validation.Valid;
+import java.util.List;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.*;
+
+@RestController
+@RequiredArgsConstructor
+@Tag(name = "Domain API", description = "Operations related to Domain")
+public class DomainApi extends RestBehavior {
+
+  public static final String DOMAIN_URI = "/api/domains";
+  private final DomainService domainService;
+
+  @LogExecutionTime
+  @Operation(summary = "Search Domains")
+  @GetMapping(DOMAIN_URI)
+  @RBAC(actionPerformed = Action.READ, resourceType = ResourceType.PAYLOAD)
+  public List<Domain> domains() {
+    return domainService.searchDomains();
+  }
+
+  @Operation(summary = "Get a Domain by ID", description = "Fetches detailed Domain info by ID")
+  @GetMapping(DOMAIN_URI + "/{domainId}")
+  @RBAC(
+      resourceId = "#domainId",
+      actionPerformed = Action.READ,
+      resourceType = ResourceType.PAYLOAD)
+  public Domain getDomain(@PathVariable String domainId) {
+    return domainService.findById(domainId);
+  }
+
+  @PostMapping(DOMAIN_URI + "/{domainId}/upsert")
+  @RBAC(actionPerformed = Action.CREATE, resourceType = ResourceType.PAYLOAD)
+  @Transactional(rollbackOn = Exception.class)
+  @ApiResponses(value = {@ApiResponse(responseCode = "200", description = "The upserted domain")})
+  @Operation(description = "Upsert a domain", summary = "Upsert domain")
+  public Domain upsertDomain(@Valid @RequestBody DomainBaseInput input) {
+    return domainService.upsertDomain(input);
+  }
+}

openaev-api/src/main/java/io/openaev/rest/domain/DomainService.java

@@ -0,0 +1,62 @@
+package io.openaev.rest.domain;
+
+import io.openaev.database.model.Domain;
+import io.openaev.database.repository.DomainRepository;
+import io.openaev.rest.domain.form.DomainBaseInput;
+import io.openaev.rest.exception.ElementNotFoundException;
+import java.time.Instant;
+import java.util.List;
+import java.util.Optional;
+import java.util.Random;
+import java.util.Set;
+import java.util.stream.Collectors;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+import static io.openaev.helper.StreamHelper.fromIterable;
+import static io.openaev.utils.StringUtils.generateRandomColor;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class DomainService {
+
+  private static final String DOMAIN_ID_NOT_FOUND_MSG = "Domain not found with id";
+
+  private final DomainRepository domainRepository;
+
+  public List<Domain> searchDomains() {
+    return fromIterable(domainRepository.findAll());
+  }
+
+  private Optional<Domain> findByName(final String name) {
+    return domainRepository.findByName(name);
+  }
+
+  public Domain findById(final String domainId) {
+    return domainRepository
+        .findById(domainId)
+        .orElseThrow(() -> new ElementNotFoundException((String.format("%s: %s", DOMAIN_ID_NOT_FOUND_MSG, domainId))));
+  }
+
+  public Domain upsertDomain(final DomainBaseInput input) {
+    return this.upsert(input.getName(), input.getColor());
+  }
+
+  public Domain upsert(final Domain domainToUpsert) {
+    return this.upsert(domainToUpsert.getName(), domainToUpsert.getColor());
+  }
+
+  public Domain upsert(final String name, final String color) {
+    Optional<Domain> existingDomain = this.findByName(name);
+    return existingDomain.orElseGet(
+        () ->
+            domainRepository.save(
+                new Domain(
+                    null, name, color != null ? color : generateRandomColor() , Instant.now(), null)));
+  }
+
+  public Set<Domain> upserts(final Set<Domain> domains) {
+    return domains.stream().map(this::upsert).collect(Collectors.toSet());
+  }
+}

openaev-api/src/main/java/io/openaev/rest/domain/form/DomainBaseInput.java

@@ -0,0 +1,23 @@
+package io.openaev.rest.domain.form;
+
+import static io.openaev.config.AppConfig.MANDATORY_MESSAGE;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import io.swagger.v3.oas.annotations.media.Schema;
+import jakarta.validation.constraints.NotBlank;
+import lombok.Getter;
+import lombok.Setter;
+
+@Getter
+@Setter
+public class DomainBaseInput {
+  @NotBlank(message = MANDATORY_MESSAGE)
+  @JsonProperty("domain_name")
+  @Schema(description = "Name of the domain")
+  private String name;
+
+  @NotBlank(message = MANDATORY_MESSAGE)
+  @JsonProperty("domain_color")
+  @Schema(description = "Color of the domain")
+  private String color;
+}

openaev-api/src/main/java/io/openaev/rest/injector_contract/InjectorContractService.java

@@ -4,8 +4,7 @@
 import static io.openaev.database.model.InjectorContract.*;
 import static io.openaev.helper.DatabaseHelper.updateRelation;
 import static io.openaev.helper.StreamHelper.fromIterable;
-import static io.openaev.utils.JpaUtils.createJoinArrayAggOnId;
-import static io.openaev.utils.JpaUtils.createLeftJoin;
+import static io.openaev.utils.JpaUtils.*;
 import static io.openaev.utils.pagination.SortUtilsCriteriaBuilder.toSortCriteriaBuilder;
 
 import com.fasterxml.jackson.databind.JsonNode;
@@ -319,6 +318,12 @@ private void selectForInjectorContractFull(
     Expression<String[]> attackPatternIdsExpression =
         createJoinArrayAggOnId(cb, injectorContractRoot, "attackPatterns");
 
+    Expression<String[]> domainsIdsExpression =
+        createJoinArrayAggOnId(cb, injectorContractRoot, "domains");
+
+    Expression<String[]> payloadDomainsIdsExpression =
+        createJoinArrayAggOnIdForJoin(cb, injectorContractPayloadJoin, "domains");
+
     // SELECT
     cq.multiselect(
             injectorContractRoot.get("id").alias("injector_contract_id"),
@@ -331,6 +336,8 @@ private void selectForInjectorContractFull(
             injectorContractInjectorJoin.get("type").alias("injector_contract_injector_type"),
             injectorContractInjectorJoin.get("name").alias("injector_contract_injector_name"),
             attackPatternIdsExpression.alias("injector_contract_attack_patterns"),
+            payloadDomainsIdsExpression.alias("payload_domains"),
+            domainsIdsExpression.alias("injector_contract_domains"),
             injectorContractRoot.get("updatedAt").alias("injector_contract_updated_at"),
             injectorContractPayloadJoin.get("executionArch").alias("payload_execution_arch"))
         .distinct(true);
@@ -359,11 +366,23 @@ private List<InjectorContractFullOutput> execInjectorFullContract(TypedQuery<Tup
                     tuple.get("collector_type", String.class),
                     tuple.get("injector_contract_injector_type", String.class),
                     tuple.get("injector_contract_attack_patterns", String[].class),
+                    resolveEffectiveDomains(
+                        tuple.get("injector_contract_domains", String[].class),
+                        tuple.get("payload_domains", String[].class)),
                     tuple.get("injector_contract_updated_at", Instant.class),
                     tuple.get("payload_execution_arch", Payload.PAYLOAD_EXECUTION_ARCH.class)))
         .toList();
   }
 
+  private List<String> resolveEffectiveDomains(String[] injectorDomains, String[] payloadDomains) {
+    String[] effectiveDomains =
+        (payloadDomains != null && payloadDomains.length > 0) ? payloadDomains : injectorDomains;
+    if (effectiveDomains == null) {
+      return List.of();
+    }
+    return Arrays.stream(effectiveDomains).filter(Objects::nonNull).distinct().toList();
+  }
+
   private void selectForInjectorContractBase(
       @NotNull final CriteriaBuilder cb,
       @NotNull final CriteriaQuery<Tuple> cq,